Need Help With Large Dynamic Sql Statement

Is there a better way to do this? or is basically how you would write a dynamic SQL Stored Procedure? Also, is this code vulnerable to SQL injection? All of the Parameters are being passed in by a SQL DataSource.

set ANSI_NULLS ON
set QUOTED_IDENTIFIER ON

go

-- =============================================
-- Author: <Author,,Name>
-- Create date: <Create Date,,>
-- Description: <Description,,>
-- =============================================

CREATE PROCEDURE [dbo].[pe_getAppraisals]

-- Add the parameters for the stored procedure here
@PType nvarChar(50),
@Client nvarChar(50),
@City nvarChar(50),
@ApptDate nvarChar(50),
@OrderDate nvarChar(50),
@Status nvarChar(50),
@AType nvarChar(50),
@Text nvarChar(50),
@OrderBy nvarChar(50),
@SortDir nvarChar(4),
@PageSize INT,
@PageNum INT

AS

DECLARE

@l_Select nvarChar(4000),
@l_From nvarChar(4000),
@l_SetWhere bit,
@l_PType nvarChar(100),
@l_Client nvarChar(100),
@l_City nvarChar(100),
@l_ApptDate nvarChar(100),
@l_OrderDate nvarChar(100),
@l_Status nvarChar(100),
@l_AType nvarChar(100),
@l_Text nvarChar(4000),
@l_SortDir nvarChar(4),
@l_TotalRecords INT

BEGIN

-- SET NOCOUNT ON added to prevent extra result sets from
-- interfering with SELECT statements.

SET NOCOUNT ON;

IF @OrderBy IS NULL
     SET @OrderBy = 'OrderDate'

IF @SortDir IS NULL
     SET @SortDir = 'DESC'

IF @SortDir = 'DESC'
     SET @l_SortDir = 'ASC'
ELSE SET @l_SortDir = 'DESC'

--Initialize SetWhere to test if a parameter has Added the keyword WHERE

SET @l_SetWhere = 0

--Create WHERE portion of the SQL SELECT Statement

IF (@PType IS NOT NULL)
BEGIN
   SET @l_PType = ' WHERE o.PropertyTypeID=' + @PType
   SET @l_SetWhere = 1
End
ELSE SET @PType = ''

IF (@Client IS NOT NULL)
BEGIN
   IF @l_SetWhere = 0
     BEGIN
        SET @l_Client = ' WHERE o.ClientID=' + @Client
       SET @l_SetWhere = 1
       END
      ELSE SET @l_Client = ' AND o.ClientID=' + @Client
    END
ELSE SET @l_Client = ''

IF (@City IS NOT NULL)
BEGIN
   IF @l_SetWhere = 0
   BEGIN
    SET @l_City = ' WHERE o.City=''' + @City + ''''
    SET @l_SetWhere = 1
   END
   ELSE SET @l_City = ' AND o.City=''' + @City + ''''
END
ELSE SET @l_City = ''
IF (@ApptDate IS NOT NULL)
BEGIN
   IF @l_SetWhere = 0
   BEGIN
     SET @l_ApptDate = ' WHERE o.ApptDate= ''' + @ApptDate + ''''
     SET @l_SetWhere = 1
   END
   ELSE SET @l_ApptDate = ' AND o.ApptDate= ''' + @ApptDate + ''''
END
ELSE SET @l_ApptDate = ''

IF (@OrderDate IS NOT NULL)
BEGIN
IF @l_SetWhere = 0
   BEGIN
     SET @l_OrderDate = ' WHERE o.OrderDate=''' + @OrderDate + ''''
     SET @l_SetWhere = 1
   END
   ELSE SET @l_OrderDate = ' AND o.OrderDate=''' + @OrderDate + ''''
END
ELSE SET @l_OrderDate = ''

IF (@Status IS NOT NULL)
BEGIN
IF @l_SetWhere = 0
   BEGIN
     SET @l_Status = ' WHERE o.StatusID=' + @Status
     SET @l_SetWhere = 1
   END
   ELSE SET @l_Status = ' AND o.StatusID=' + @Status
  END
ELSE SET @l_Status = ''


IF (@AType IS NOT NULL)
BEGIN
   IF @l_SetWhere = 0
   BEGIN
     SET @l_AType = ' WHERE o.ReportID=' + @AType
     SET @l_SetWhere = 1
   END
  ELSE SET @l_AType = ' AND o.ReportID=' + @AType
END
ELSE SET @l_AType = ''

IF (@Text IS NOT NULL)
BEGIN
   IF @l_SetWhere = 0
   BEGIN
   SET @l_Text = ' WHERE (o.FileNumber LIKE ''' + @Text + '%''' +
   ' OR o.LoanOfficer LIKE ''' + @Text + '%''' +
   ' OR o.Borrower LIKE ''' + @Text + '%''' +
   ' OR o.StreetAddrA LIKE ''' + @Text + '%''' +
   ' OR o.State LIKE ''' + @Text + '%''' +
   ' OR o.ContactName LIKE ''' + @Text + '%'')'
   SET @l_SetWhere = 1
END
ELSE SET @l_Text = ' AND (o.FileNumber LIKE ''' + @Text + '%''' +
   ' OR o.LoanOfficer LIKE ''' + @Text + '%''' +
   ' OR o.Borrower LIKE ''' + @Text + '%''' +
   ' OR o.StreetAddrA LIKE ''' + @Text + '%''' +
   ' OR o.State LIKE ''' + @Text + '%''' +
   ' OR o.ContactName LIKE ''' + @Text + '%'')'
END
ELSE SET @l_Text = ''

--Build the SQL SELECT Statement

SET @l_Select = 'o.OrderID AS OrderID, o.FileNumber AS FileNumber, o.OrderDate AS OrderDate, o.ClientID AS ClientID, o.ClientFileNumber AS ClientFileNumber, o.PropertyTypeID AS PropertyTypeID, o.EstimatedValue AS EstimatedValue, o.PurchaseValue AS PurchaseValue, o.LoanOfficer AS LoanOfficer, o.ReportFee AS ReportFee, o.FeeBillInd AS FeeBillInd, o.FeeCollectInd AS FeeCollectInd, o.CollectAmt AS CollectAmt, o.Borrower AS Borrower, o.StreetAddrA AS StreetAddrA, o.StreetAddrB AS StreetAddrB, o.City AS City, o.State AS State, o.Zip AS Zip, o.ContactName AS ContactName, o.PhoneA AS PhoneA, o.PhoneB AS PhoneB, o.ApptDate AS ApptDate, o.ApptTime AS ApptTime, o.AppraiserID AS AppraiserID, o.InspectionDate AS InspectionDate, o.DateMailed AS DateMailed, o.TrackingInfo AS TrackingInfo, o.ReviewedBy AS ReviewedBy, o.StatusID AS StatusID, o.Comments AS Comments, o.SpecialNotes AS SpecialNotes, o.EmailInd AS EmailInd, o.MgmtName AS MgmtName, o.MgmtContactName AS MgmtContactName, o.MgmtAddress AS MgmtAddress, o.MgmtPhone AS MgmtPhone, o.MgmtFax AS MgmtFax, o.MgmtFee AS MgmtFee, o.MgmtNotes AS MgmtNotes, o.LoginName AS LoginName, on1.NotesDesc AS PreNotesDesc, on2.NotesDesc AS PostNotesDesc, os.StatusDesc AS StatusDesc, ot.ReportDesc AS ReportDesc, ot.ReportFee AS ReportPrice, ot.ReportSeq AS ReportSeq, pc.PriceDesc AS PriceDesc, pt.PropertyTypeDesc AS PropertyTypeDesc, l.LoginName AS AppraiserName, l2.LoginName As ClientName'

SET @l_From = 'Orders AS o LEFT OUTER JOIN
OrderNotes AS on1 ON o.PreNotesID = on1.NotesID LEFT OUTER JOIN
OrderNotes AS on2 ON o.PostNotesID = on2.NotesID LEFT OUTER JOIN
OrderStatus AS os ON o.StatusID = os.StatusID LEFT OUTER JOIN
OrderTypes AS ot ON o.ReportID = ot.ReportID LEFT OUTER JOIN
PriceCodes AS pc ON ot.PriceID = pc.PriceID LEFT OUTER JOIN
PropertyTypes AS pt ON o.PropertyTypeID = pt.PropertyTypeID LEFT OUTER JOIN
Logins AS l ON o.AppraiserID = l.LoginID LEFT OUTER JOIN
Logins AS l2 ON o.ClientID = l.LoginID'

SET @l_TotalRecords = @PageSize * @PageNum

PRINT ' ORDER BY ' + @OrderBy + ' ' + @l_SortDir + ') ORDER BY ' + @OrderBy + ' ' + @SortDir

Execute('SELECT TOP(' + @PageSize + ') * FROM (SELECT TOP(' + @l_TotalRecords + ') ' + @l_Select + ' FROM ' + @l_From + @l_PType + @l_Client + @l_City + @l_ApptDate + @l_OrderDate + @l_Status + @l_AType + @l_Text + ' ORDER BY ' + @OrderBy + ' ' + @l_SortDir + ') AS rsltTbl ORDER BY ' + @OrderBy + ' ' + @SortDir)

END

Thank You,

Jason